Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before...
CVE-2026-103087
Uncontrolled recursion in the Gosub browser engine (gosub-engine) through 0.1.0 and main before commit 46868b3 allows a
2026-09-30 归档
今日共收录 1598 条安全情报，包含 728 个 CVE，467 篇安全通告，以及 100 篇研究论文。
← 返回归档列表AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions...
CVE-2026-103056
AiSOC versions 7.2.0 before 12.0.0 contain a command injection vulnerability in the actions service that builds CrowdStr
AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module...
CVE-2026-103054
AiSOC versions before 12.0.0 contain an authorization bypass vulnerability in the MSSP module that allows authenticated
A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function...
CVE-2026-102793
A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function set_time_zone of the file /
A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown...
CVE-2026-102794
A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /ap
A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function set_syslog...
CVE-2026-102792
A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function set_syslog of the file /api/ZRnetw
U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read_slotted_partition...
CVE-2026-71974
U-Boot before 2026.10-rc3 contains an out-of-bounds write vulnerability in read_slotted_partition() that fails to valida
The "supplier_no" parameter used in the business allocation search feature is vulnerable to time...
CVE-2026-72510
The "supplier_no" parameter used in the business allocation search feature is vulnerable to time-based blind SQL injecti
The "reportType" parameter in the product summary report feature within the balancing reports...
CVE-2026-72507
The "reportType" parameter in the product summary report feature within the balancing reports section is susceptible to
LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with...
CVE-2026-103041
LightLLM through 1.2.0 multimodal deployments expose an unauthenticated RPyC cache service with pickle deserialization e
The file export endpoint allows any unauthenticated attacker to export arbitrary database tables...
CVE-2026-71379
The file export endpoint allows any unauthenticated attacker to export arbitrary database tables by sending a crafted PO
An attacker can construct a request that, if issued by another application user, will cause...
CVE-2026-71189
An attacker can construct a request that, if issued by another application user, will cause JavaScript code supplied by
The "screenID" parameter in the electronic transaction queue viewer feature within the manual...
CVE-2026-68068
The "screenID" parameter in the electronic transaction queue viewer feature within the manual transactions section is su
The "pattern" parameter used in search function in the home page of the TMS application is...
CVE-2026-68954
The "pattern" parameter used in search function in the home page of the TMS application is vulnerable to time-based blin
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an...
CVE-2026-70356
The TMS file upload endpoint fails to enforce server-side file type restrictions, allowing an attacker to upload and exe
The "search" parameter in the view audit logs feature within the utilities section is susceptible...
CVE-2026-63713
The "search" parameter in the view audit logs feature within the utilities section is susceptible to a time-based blind
@xhmikosr/decompress: Path traversal via symlink chain
CVE-2026-101894
### Impact When extracting an untrusted archive with the default `decompress(input, output)` API, a crafted archive con
PyJWT: Non-canonical signature segments enable raw-token revocation bypass
CVE-2026-102269
## Summary PyJWT 2.13.0 accepts compact JWS signature segments containing characters that are not in the Base64URL alph
PyJWT: Asymmetric-PEM detection bypass: whitespace/line-ending-mutated public keys skip the HS/asymmetric confusion guard
CVE-2026-102268
**Prerequisites** (both conditions must hold; both are deployment properties, not attacker-controlled at request time):
Tracekit: Tamper-Evident Intent-Reasoning-Action Auditing for Autonomous Coding Agents
Tracekit 是面向自主编码代理的开源、无依赖审计系统，针对的核心问题是：编码代理会读取不可信文件、执行 shell 命令、派生带极少监督的子代理，但事后留存的往往只是可被随意编辑的日志，无法作为可信证据。Tracekit 为每个代理会